Members

The state of the image file. This member can be one of the following values.

Value

Meaning

IMAGE_NT_OPTIONAL_HDR_MAGIC

The file is an executable image. This value is defined as
IMAGE_NT_OPTIONAL_HDR32_MAGIC in a 32-bit application and as
IMAGE_NT_OPTIONAL_HDR64_MAGIC in a 64-bit application.

IMAGE_NT_OPTIONAL_HDR32_MAGIC

0x10b

The file is an executable image.

IMAGE_NT_OPTIONAL_HDR64_MAGIC

0x20b

The file is an executable image.

IMAGE_ROM_OPTIONAL_HDR_MAGIC

0x107

The file is a ROM image.

MajorLinkerVersion

The major version number of the linker.

MinorLinkerVersion

The minor version number of the linker.

SizeOfCode

The size of the code section, in bytes, or the sum of all such sections if there are multiple code
sections.

SizeOfInitializedData

The size of the initialized data section, in bytes, or the sum of all such sections if there are multiple
initialized data sections.

SizeOfUninitializedData

The size of the uninitialized data section, in bytes, or the sum of all such sections if there are multiple
uninitialized data sections.

AddressOfEntryPoint

A pointer to the entry point function, relative to the image base address. For executable files, this is
the starting address. For device drivers, this is the address of the initialization function. The entry point
function is optional for DLLs. When no entry point is present, this member is zero.

BaseOfCode

A pointer to the beginning of the code section, relative to the image base.

BaseOfData

A pointer to the beginning of the data section, relative to the image base.

ImageBase

The preferred address of the first byte of the image when it is loaded in memory. This value is a multiple
of 64K bytes. The default value for DLLs is 0x10000000. The default value for applications is 0x00400000, except
on Windows CE where it is 0x00010000.

SectionAlignment

The alignment of sections loaded in memory, in bytes. This value must be greater than or equal to the
FileAlignment member. The default value is the page size for the system.

FileAlignment

The alignment of the raw data of sections in the image file, in bytes. The value should be a power of 2
between 512 and 64K (inclusive). The default is 512. If the SectionAlignment member
is less than the system page size, this member must be the same as
SectionAlignment.

MajorOperatingSystemVersion

The major version number of the required operating system.

MinorOperatingSystemVersion

The minor version number of the required operating system.

MajorImageVersion

The major version number of the image.

MinorImageVersion

The minor version number of the image.

MajorSubsystemVersion

The major version number of the subsystem.

MinorSubsystemVersion

The minor version number of the subsystem.

Win32VersionValue

This member is reserved and must be 0.

SizeOfImage

The size of the image, in bytes, including all headers. Must be a multiple of
SectionAlignment.

SizeOfHeaders

The combined size of the following items, rounded to a multiple of the value specified in the
FileAlignment member.

The image file checksum. The following files are validated at load time: all drivers, any DLL loaded at
boot time, and any DLL loaded into a critical system process.

Subsystem

The subsystem required to run this image. The following values are defined.

Value

Meaning

IMAGE_SUBSYSTEM_UNKNOWN

0

Unknown subsystem.

IMAGE_SUBSYSTEM_NATIVE

1

No subsystem required (device drivers and native system processes).

IMAGE_SUBSYSTEM_WINDOWS_GUI

2

Windows graphical user interface (GUI) subsystem.

IMAGE_SUBSYSTEM_WINDOWS_CUI

3

Windows character-mode user interface (CUI) subsystem.

IMAGE_SUBSYSTEM_OS2_CUI

5

OS/2 CUI subsystem.

IMAGE_SUBSYSTEM_POSIX_CUI

7

POSIX CUI subsystem.

IMAGE_SUBSYSTEM_WINDOWS_CE_GUI

9

Windows CE system.

IMAGE_SUBSYSTEM_EFI_APPLICATION

10

Extensible Firmware Interface (EFI) application.

IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER

11

EFI driver with boot services.

IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER

12

EFI driver with run-time services.

IMAGE_SUBSYSTEM_EFI_ROM

13

EFI ROM image.

IMAGE_SUBSYSTEM_XBOX

14

Xbox system.

IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION

16

Boot application.

DllCharacteristics

The DLL characteristics of the image. The following values are defined.

Value

Meaning

0x0001

Reserved.

0x0002

Reserved.

0x0004

Reserved.

0x0008

Reserved.

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

0x0040

The DLL can be relocated at load time.

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

0x0080

Code integrity checks are forced. If you set this flag and a section contains only uninitialized data,
set the PointerToRawData member of
IMAGE_SECTION_HEADER for that section to
zero; otherwise, the image will fail to load because the digital signature cannot be verified.

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

0x0100

The image is compatible with data execution prevention (DEP).

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

0x0200

The image is isolation aware, but should not be isolated.

IMAGE_DLLCHARACTERISTICS_NO_SEH

0x0400

The image does not use structured exception handling (SEH). No handlers can be called in this
image.

IMAGE_DLLCHARACTERISTICS_NO_BIND

0x0800

Do not bind the image.

0x1000

Reserved.

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

0x2000

A WDM driver.

0x4000

Reserved.

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

0x8000

The image is terminal server aware.

SizeOfStackReserve

The number of bytes to reserve for the stack. Only the memory specified by the
SizeOfStackCommit member is committed at load time; the rest is made available one
page at a time until this reserve size is reached.

SizeOfStackCommit

The number of bytes to commit for the stack.

SizeOfHeapReserve

The number of bytes to reserve for the local heap. Only the memory specified by the
SizeOfHeapCommit member is committed at load time; the rest is made available one
page at a time until this reserve size is reached.

SizeOfHeapCommit

The number of bytes to commit for the local heap.

LoaderFlags

This member is obsolete.

NumberOfRvaAndSizes

The number of directory entries in the remainder of the optional header. Each entry describes a location
and size.

Remarks

The number of directories is not fixed. Check the NumberOfRvaAndSizes member before
looking for a specific directory.

The actual structure in WinNT.h is named IMAGE_OPTIONAL_HEADER32
and IMAGE_OPTIONAL_HEADER is defined as
IMAGE_OPTIONAL_HEADER32. However, if _WIN64 is
defined, then IMAGE_OPTIONAL_HEADER is defined as
IMAGE_OPTIONAL_HEADER64.

Requirements

See Also

The feedback system for this content will be changing soon. Old comments will not be carried over. If content within a comment thread is important to you, please save a copy. For more information on the upcoming change, we invite you to read our blog post.